Replaces the content (and, if provided, the mentions) of an existing activity record. The type and parent entity are fixed at creation.

Authorization. Only the user who created the activity may edit it. The caller must also be able to access the parent entity and hold the user permission matching its type: employers:write, leads:update, workflows:update, customers:update or meetings:update. No OAuth2 scope beyond a valid token is required.

Behaviour. The content is sanitized as on creation. If it differs from the current content, an audit entry (before/after) is written and lastEditedAt/lastEditedBy are set. If the content or the mentions changed, an ActivityUpdated event is published. Sending identical content and mentions is a no-op that still returns 200 OK with the record.

Errors. 404 if the activity or a mentioned user does not exist in the caller's tenant; 400 if the request is invalid (empty content, invalid mentions), and 400 with error code 40000 if the caller is not the creator, lacks the permission, or cannot access the parent entity.

{
  "htmlContent": "<p>Customer accepted the renewal quote.</p>",
  "mentions": [
    {
      "type": "user",
      "entityId": "123e4567-e89b-12d3-a456-426614174000",
      "label": "John Doe",
      "order": 0
    }
  ]
}

{
  "id": "3c8a1f2e-5d4b-4a9c-b7e6-1f2a3b4c5d6e",
  "typeId": "6f1c2a7e-3b4d-4e8f-9a01-2c3d4e5f6a7b",
  "employerId": "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d",
  "customerId": "b2e4c6d8-1a3b-4c5d-8e7f-9a0b1c2d3e4f",
  "leadId": "0d9e8f7a-6b5c-4d3e-8f2a-1b0c9d8e7f6a",
  "workflowId": "4e5f6a7b-8c9d-4e0f-a1b2-c3d4e5f6a7b8",
  "meetingId": "7b8c9d0e-1f2a-4b3c-9d4e-5f6a7b8c9d0e",
  "activityDate": "2026-03-15T09:30:00Z",
  "htmlContent": "<p>Spoke with the customer about renewing the car insurance policy.</p>",
  "lastEditedAt": "2026-03-16T14:05:00Z",
  "lastEditedBy": "5d6e7f8a-9b0c-4d1e-a2f3-4a5b6c7d8e9f"
}